# Security of Community edge drivers? **URL:** \ **Category:** Community Created Drivers\ **Created:** [January 18, 2023, 9:18pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661 "2023-01-18T21:18:21Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 18, 2023, 9:18pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/1 "2023-01-18T21:18:21Z")
Has this been answered before. All of these phenomenal edge drivers that community members and creating and publishing, what’s to stop them from simply deleting it and/or updating one and perhaps screwing it up. I’m not saying anyone would even do this and I’m forever grateful for them but was wondering what would actually happen? Would your devices just stop working? Can you install a driver and then stop things like this happening? ---
**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\ **Post date:** [January 18, 2023, 9:25pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/2 "2023-01-18T21:25:10Z")
> [@jjmucker](#): > > Would your devices just stop working? Can you install a driver and then stop things like this happening? If they deleted the driver from their channel it would still be on your hub so things wouldn’t break. On the other hand if they deliberately or accidentally ballsed up an update that would be copied to your hub, unless … I believe that you can protect yourself by unenrolling from the channel containing the driver. A similar problem exists with custom capabilities. ---
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 18, 2023, 9:26pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/3 "2023-01-18T21:26:19Z")
Ah I see. Is there any officially statement on that un enrolment safety net? Thanks. ---
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 18, 2023, 9:29pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/4 "2023-01-18T21:29:23Z")
> [@orangebucket](#): > > A similar problem exists with custom capabilities What is that? ---
**Author:** ![JDRoberts](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/jdroberts/32/56577_2.png) [@JDRoberts](https://community.smartthings.com/u/JDRoberts)\ **Post date:** [January 18, 2023, 9:30pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/5 "2023-01-18T21:30:27Z")
> [@jjmucker](#): > > Has this been answered before. It’s been discussed at length, including with staff, but I don’t know that there’s really been an answer. 🤔 [General security question about community provided edge drivers](https://community.smartthings.com/t/general-security-question-about-community-provided-edge-drivers/232465/) ---
**Author:** ![Davec](https://avatars.discourse-cdn.com/v4/letter/d/a4c791/32.png) [@Davec](https://community.smartthings.com/u/Davec)\ **Post date:** [January 18, 2023, 10:01pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/6 "2023-01-18T22:01:10Z")
To be diplomatic, the discussion was not pleasant. I gave up, there were some very excitable and rude contributions. I will not use any community drivers/apps or websites where the code is not open source or certified in someway by Smartthings. I have spent a lot of time coming up to speed so that I can support my own requirements, I am far from convinced whether it was worth the time and effort, I should probably just have left Smartthings… BUT, I have to say the platform actually looks pretty good now…be interesting to see. Hopefully I will be proven wrong. ---
**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\ **Post date:** [January 18, 2023, 10:03pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/7 "2023-01-18T22:03:04Z")
> [@jjmucker](#): > > What is that? There is nothing to stop you deleting or updating custom capabilities that you created. ---
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 18, 2023, 10:23pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/8 "2023-01-18T22:23:24Z")
Yeah but what is custom capabilities? You mean taking an edge driver and modifying it yourself? ---
**Author:** ![blueyetisoftware](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/blueyetisoftware/32/143828_2.png) [@blueyetisoftware](https://community.smartthings.com/u/blueyetisoftware)\ **Post date:** [January 18, 2023, 10:49pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/9 "2023-01-18T22:49:41Z")
You can unenroll from the driver channel if you don’t want updates. The driver will remain installed. If you don’t trust the developer to send clean updates, I’m not sure I’d trust the initial version either. These drivers are sandboxed from the internet and from each other, so I’m not sure there is much malicious activity that can occur, that couldn’t be solved by just uninstalling the driver. ---
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 18, 2023, 11:00pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/10 "2023-01-18T23:00:04Z")
Yeah I’m not saying the developer would purposely send an update to screw anyone but if the driver is working as you expect then I see no reason to allow updates until maybe one was really needed. Look at the state of some of the ST app updates we get from android or Apple ios, some, if not most of the time the update screws something up lol. ---
**Author:** ![blueyetisoftware](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/blueyetisoftware/32/143828_2.png) [@blueyetisoftware](https://community.smartthings.com/u/blueyetisoftware)\ **Post date:** [January 18, 2023, 11:02pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/11 "2023-01-18T23:02:37Z")
You could just unenroll after install then, missing out on any new features or bug fixes. It would be nice if the ST app just had an auto update toggle in the driver menu. ---
**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\ **Post date:** [January 18, 2023, 11:04pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/12 "2023-01-18T23:04:51Z")
> [@jjmucker](#): > > Yeah but what is custom capabilities? > **[Custom Capabilities | Developer Documentation | SmartThings](https://developer.smartthings.com/docs/devices/capabilities/custom-capabilities)** > > Devices with custom Capabilities are not supported by the Works with SmartThings certification program at this time. ---
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 19, 2023, 10:36am UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/14 "2023-01-19T10:36:54Z")
I would say that’s fair of them to do so and it’s the users own choice if they want to purchase it. Similar to developers selling groovy apps isn’t it. ---
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 19, 2023, 10:45am UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/16 "2023-01-19T10:45:56Z")
Absolutely ---
**Author:** ![frayer](https://avatars.discourse-cdn.com/v4/letter/f/82dd89/32.png) [@frayer](https://community.smartthings.com/u/frayer)\ **Post date:** [January 19, 2023, 11:01am UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/17 "2023-01-19T11:01:04Z")
I don’t understand why Smartthings doesn’t simply provide an option to “lock” drivers in the installed state and disallow automatic updates. This could be done for individual drivers, for all drivers of a certain developer, or for all installed drivers. Anything would be better than no option at all, as it is now. For me, this is not really a security question, but a question of keeping my smart home in a functional state. ANY automatic update can break functionality, on any platform. ---
**Author:** ![jjmucker](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jjmucker](https://community.smartthings.com/u/jjmucker)\ **Post date:** [January 19, 2023, 11:02am UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/18 "2023-01-19T11:02:21Z")
Yeah that’s my whole point of this post. As a user and if I’m happy that things are running as I’d like, to have the option to ‘lock’ it, as you say, would be ideal. ---
**Author:** ![csstup](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/csstup/32/141481_2.png) [@csstup](https://community.smartthings.com/u/csstup)\ **Post date:** [January 19, 2023, 11:34am UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/19 "2023-01-19T11:34:21Z")
> [@Davec](#): > > A well intentioned developer is testing the water with his drivers to see if monetisation is feasible. ie he plans to charge for the driver in the future > IMHO I think this is the only reason a developer will keep his source code private This is _not_ the reason I have kept some of my Edge driver source code off GitHub and/or open sourcing. Some of my work is there, some of it is not. Reasons vary for both but none of them are about monetizing anything on Edge. ---
**Author:** ![Mariano\_Colmenarejo](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/mariano_colmenarejo/32/220132_2.png) [@Mariano\_Colmenarejo](https://community.smartthings.com/u/Mariano_Colmenarejo)\ **Post date:** [January 19, 2023, 12:39pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/20 "2023-01-19T12:39:26Z")
> [@Davec](#): > > There is another scenario, A well intentioned developer is testing the water with his drivers to see if monetisation is feasible. ie he plans to charge for the driver in the future (IMHO I think this is the only reason a developer will keep his source code private) Don’t get me wrong, there is nothing ‘wrong’ with this, good luck to them!!! You forget that there may be more reasons not to publish all the code I have **right now**. For example, I don’t want to monetize any of my work, apart from the fact that just like you did, some users have invited me to a beer and I appreciate it. I just want to solve the problems with my devices and share them with whoever wants to receive them, but I also don’t want another user, who doesn’t share his code, legitimately, to monetize the code for me by copying and pasting. I have it in my will that if I die suddenly they publish all my drivers that are not published 🤦‍♂️ More than a year ago I commented in another post that it would be good if automatic updates were optional, although the only thing that achieves this is that we wait to see if someone breaks something or not before updating ---
**Author:** ![Mariano\_Colmenarejo](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/mariano_colmenarejo/32/220132_2.png) [@Mariano\_Colmenarejo](https://community.smartthings.com/u/Mariano_Colmenarejo)\ **Post date:** [January 19, 2023, 12:51pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/24 "2023-01-19T12:51:06Z")
> [@Davec](#): > > Yes…we all make mistakes Don’t worry, my dog drank it. ---
**Author:** ![Mariano\_Colmenarejo](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/mariano_colmenarejo/32/220132_2.png) [@Mariano\_Colmenarejo](https://community.smartthings.com/u/Mariano_Colmenarejo)\ **Post date:** [January 19, 2023, 1:10pm UTC](https://community.smartthings.com/t/security-of-community-edge-drivers/256661/25 "2023-01-19T13:10:54Z")
> [@Davec](#): > > Argh…sorry this thread is morphing into a repeat of the previous thread…Apologies…I won’t post again You don’t need to get angry or apologize, what you can’t expect is that we all agree with you if we don’t agree. You have your very respectable reasons and others have ours, as respectable as yours. Participating in a forum does not imply having to renounce your convictions, we simply debate and each one draws their own conclusions and acts accordingly. It does not depend on what you or I think, the solution that they apply will be the one that decides who has that competence. By the way, I don’t have a dog! 😉 [Next page](https://community.smartthings.com/t/security-of-community-edge-drivers/256661.md?page=2)